V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/4180_setup_ssh.sh

@@ -15,6 +15,7 @@ guard_sourcing
 #######################################
 # Setup ssh server.
 # Globals:
+#   BASH_REMATCH
 #   DIR_BAK
 #   DIR_LOG
 #   TARGET
@@ -24,10 +25,6 @@ guard_sourcing
 #   VAR_SETUP_PATH
 #   ssh_port
 #   ssh_root_ca
-#   user_user0_name
-#   user_user1_name
-#   user_user2_name
-#   user_user3_name
 # Arguments:
 #   None
 # Returns:
@@ -40,21 +37,13 @@ setup_ssh() {
   # Variable declaration
   #######################################
   declare -a ary_user=()
-  declare -i max_index=0 index i
-  declare var=""
-
-  ### Search all set variables for user_userN_name patterns.
-  while IFS='=' read -r var; do
-    if [[ "${var}" =~ ^user_user([0-9]+)_name$ ]]; then
-      index="${BASH_REMATCH[1]}"
-      (( index > max_index )) && max_index="${index}"
-    fi
-  done < <(compgen -v)
+  declare -i i
+  declare var_auth="" var_name=""
 
   ### Only process those for which both *_name and *_authentication_access_ssh are set.
-  for ((i = 0; i <= max_index; i++)); do
-    declare var_auth="user_user${i}_authentication_access_ssh"
-    declare var_name="user_user${i}_name"
+  for ((i = 0; i <= VAR_USER_MAX; i++)); do
+    var_auth="user_user${i}_authentication_access_ssh"
+    var_name="user_user${i}_name"
 
     if [[ -v "${var_auth}" && -v "${var_name}" && "${!var_auth}" == "true" ]]; then
       ary_user+=("${!var_name}")
@@ -64,11 +53,8 @@ setup_ssh() {
   rm -rf "${TARGET}"/etc/ssh/ssh_host_*key*
 
   do_in_target "${TARGET}" ssh-keygen -o -N "" -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -C "root@${VAR_FINAL_FQDN}-$(date -I)"
-  do_log "info" "true" "Generated ed25519 SSH Key, executed in: '${TARGET}'."
 
   do_in_target "${TARGET}" ssh-keygen -o -N "" -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -C "root@${VAR_FINAL_FQDN}-$(date -I)"
-  do_log "info" "true" "Generated RSA4096 SSH Key, executed in: '${TARGET}'."
-
 
   mkdir -p "${DIR_BAK}/etc/ssh"
   cp "${TARGET}/etc/ssh/sshd_config" "${DIR_BAK}/etc/ssh/sshd_config.bak"
@@ -83,23 +69,23 @@ setup_ssh() {
   chmod 0600 "${TARGET}/etc/ssh/ssh_config"
 
   # shellcheck disable=SC2153
-  sed -i "s/ListenAddress                0.0.0.0/ListenAddress                ${VAR_FINAL_IPV4}/" "${TARGET}/etc/ssh/sshd_config"
+  sed -i -E "s|^\s*ListenAddress\s+.*$|$(printf '%-30s%s' 'ListenAddress' "${VAR_FINAL_IPV4}")|" "${TARGET}/etc/ssh/sshd_config"
 
   if [[ -n "${VAR_FINAL_IPV6}" ]]; then
-    sed -i "s/ListenAddress                ::/ListenAddress                ${VAR_FINAL_IPV6}/" "${TARGET}/etc/ssh/sshd_config"
+    sed -i -E "s|^\s*ListenAddress\s+::.*$|$(printf '%-30s%s' 'ListenAddress' "${VAR_FINAL_IPV6}")|" "${TARGET}/etc/ssh/sshd_config"
   else
     sed -i "/^\s*ListenAddress\s*::/d" "${TARGET}/etc/ssh/sshd_config"
   fi
 
-  sed -i "s/Port                         MUST_BE_CHANGED/Port                         ${ssh_port}/" "${TARGET}/etc/ssh/sshd_config"
+  sed -i -E "s|^\s*Port\s+.*$|$(printf '%-30s%s' 'Port' "${ssh_port}")|" "${TARGET}/etc/ssh/sshd_config"
 
   if (( ${#ary_user[@]} > 0 )); then
-    sed -i "s/AllowUsers                   root/AllowUsers                   root ${ary_user[*]}/" "${TARGET}/etc/ssh/sshd_config"
+    sed -i -E "s|^\s*AllowUsers\s+.*$|$(printf '%-30s%s' 'AllowUsers' "root ${ary_user[*]}")|" "${TARGET}/etc/ssh/sshd_config"
   fi
 
   if [[ -n "${ssh_root_ca}" ]]; then
     install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}${ssh_root_ca}" "${TARGET}/etc/ssh/"
-    sed -i "s/TrustedUserCAKeys            none/TrustedUserCAKeys            \/etc\/ssh\/${ssh_root_ca}/" "${TARGET}/etc/ssh/sshd_config"
+     sed -i -E "s|^\s*TrustedUserCAKeys\s+.*$|$(printf '%-30s%s' 'TrustedUserCAKeys' "/etc/ssh/${ssh_root_ca}")|" "${TARGET}/etc/ssh/sshd_config"
   fi
 
   do_in_target_script "${TARGET}" "sshd -T >| ${DIR_LOG}/sshd_config.log"
@@ -113,6 +99,7 @@ setup_ssh() {
   # The chmod +x command ensures that the file is executed in every shell session.          #
   ###########################################################################################
   echo "readonly TMOUT=14400" >| "${TARGET}/etc/profile.d/idle-users.sh"
+  # TODO: Check empty value
   #echo "readonly HISTFILE" >> "${TARGET}/etc/profile.d/idle-users.sh"
   chmod +x "${TARGET}/etc/profile.d/idle-users.sh"